Traversing firewalls

ABSTRACT

A remote administrator device is provided outside a firewall that prevents remote devices from accessing, but allows remote devices to send electronic mail messages to a plurality of local network devices. The remote administrator device can send an electronic mail message to a respective one of the plurality of local network devices behind the firewall. The electronic mail message can include instructions for the respective local network device to establish a connection with the remote administrator device through the firewall. Once the connection is established, the remote administrator device can monitor state data received over the connection for the respective local network device.

CROSS REFERENCE TO RELATED APPLICATION

This application is a divisional of U.S. patent application Ser. No.10/394,643, filed on Mar. 21, 2003, entitled “TRAVERSING FIREWALLS”—theaforementioned application being hereby incorporated by reference in itsentirety.

BACKGROUND

This invention relates to remotely establishing network communications.More particularly, the invention is directed to traversing a networkfirewall to effect network communications where such activity would beotherwise frustrated by common security configurations.

Generally speaking, a computer network is made up of a number ofinterconnected devices such as desktop computers, servers, andperipherals including printers, copiers, scanners, fax machines,multifunction devices, and electronic storage devices. Each device has anumber of settings to be configured from time to time. These settingsinclude IP (Internet Protocol) addresses; subnet masks; IP gatewayaddresses; proxy server assignments; community names; device passwords;location descriptions; system contact; frame type selections; protocolstack selections; print resolution; duplexing; and paper tray selectionjust to name a few. A single setting for certain attributes, such as theIP gateway and subnet mask, may be applied across multiple devices. Fordevices such as printers, different settings for paper tray output andprint resolution are applied to each device individually. Many networkdevices such as printers also have operating parameters that can bemonitored. Examples of operating parameters include toner levels, numberof pages printed, and the current operational status of the device.

In the past, configuration required physically accessing each device andentering the desired settings though a control panel or other interfaceprovided by the device. As the number of devices on the networkincreases, so does the difficulty in managing the configuration of thedevices. This is especially true as the geography of the networkexpands. In today's businesses, it is not uncommon for a network toexpand across buildings, across states, or even across countries—makingphysical access to many devices difficult if not impossible.Consequently, methods and systems have evolved for remotely accessingand configuring network devices.

One solution involves embedding a web server in each device for managingthe configuration of that device. Using a conventional web browser, asystem administrator can browse to the address of a particular device.The embedded web server returns a web page allowing the administrator toselect configuration settings for that device. While this allows remoteconfiguration, it requires the administrator to manually browse to andconfigure each device one at a time.

A second solution involves placing network devices under the control ofa device management application such as Hewlett-Packard Company's “WebJetAdmin”®. The software is usually installed on a network server orworkstation. Using a conventional browser, a system administrator canbrowse to the device management application which in turn communicateswith network devices allowing the administrator to monitor operatingparameters as well as select the configuration settings to be applied toa device individually or to a group of devices simultaneously.

From within a local network, using a browser to access a web serverembedded in a device or to access a device management application isrelatively simple. Each is typically accessed through a private IP(Internet Protocol) address. It is often desirable to monitor orconfigure a device from outside the local network. However, a firewallis often employed that prevents a browser from establishing a connectionfrom outside the local network. A firewall often implements networkproxies as a kind of one-way door through the firewall between the localnetwork and the Internet. Browsers and other applications are allowed toinitiate outbound connections, but outside browsers and otherapplications are generally not allowed to initiate inbound connections.A prominent exception to this pattern is electronic mail messages, whichare typically allowed to flow freely in both directions.

For example, a business may lease a multifunction network peripheralsuch as a digital copier/printer/scanner from an office supply service.The business connects the device to its local network. The deviceincludes an embedded web server that enables it to be configured andmonitored remotely. Under the terms of the lease, the office supplyservice may be responsible for supplying toner and maintaining thedevice. However, the business employs a firewall to protect its localnetwork. That firewall prevents the office supply service from accessingthe device from outside the local network thus increasing the costsinvolved with maintaining the device.

DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic representation of a network environment in whichembodiments of the present invention may be implemented.

FIG. 2 is a block diagram illustrating the logical components of a statemachine and a remote computer according to an embodiment of the presentinvention.

FIG. 3 is a flow diagram illustrating steps taken to traverse a firewallto establish a network connection for monitoring and adjusting statedata according to an embodiment of the present invention.

FIG. 4 is a flow diagram illustrating steps taken to traversing afirewall to establish a network connection for monitoring and adjustingstate data according to another embodiment of the present invention.

DETAILED DESCRIPTION

Firewalls perform an important function when protecting local areanetworks from outside intrusions. However, by blocking communicationsoriginating outside the local area network, a firewall sometime blocksdesirable network activities. Embodiments of the present invention willenable a remote device to initiate a network connection with a deviceoperating behind a firewall.

The following description is broken into sections. The first sectiondescribes an environment in which embodiments of the present inventionmay be implemented. The second section describes the physical andlogical components used to implement embodiments of the presentinvention. The third section describes steps taken to practiceembodiments of the present invention.

ENVIRONMENT: FIG. 1 illustrates a network environment 10 in which itwould be advantageous to implement embodiments of the present invention.Environment 10 includes LAN (Local Area Network) 12. LAN 12 representsgenerally any private network and includes desktop computer 14, printer16, and laptop computer 18. Devices 14-18 are interconnected by privatelink 20. Devices 12-14 can be referred to as state machines.

In general, a state machine is any device that stores the status ofsomething at a given time and can operate on input to change the statusand/or cause an action or output to take place for any given change.Instructions, such as printing instructions sent to printer 16, is inputthat changes one or more states of printer 16 and may cause otheractions, including printing, to take place. The term state refers to thestatus of an application or process. For example, the status of printer16 includes, among items not listed, whether or not it is currentlyprinting, whether or not it is malfunctioning, the number of pages ithas printed, its toner level, its paper level, its network address, andits default print settings. The state of a computer 14 or 18 can referto a program running on the computer 12 or 14 or its status.

Private link 20 represents generally any cable, wireless, or remoteconnection via a telecommunication link, an infrared link, a radiofrequency link, and/or any other connector or system that provideselectronic communication between state machines 14-18. Public link 20represents generally any cable, wireless, or remote connection via atelecommunication link, an infrared link, a radio frequency link, and/orany other connector or system that enables electronic communicationbetween remote computer 24 and state machines 14-18 of LAN 12. Publiclink 22 may, for example, be the Internet. The terms public and privateare relative and, in this example, are taken from the perspective of LAN12. Remote computer 24 may be part of a private network different fromLAN 12.

Private Link 20 includes firewall 26. Firewall 26 represents any systemdesigned to prevent unauthorized access to or from LAN 12. Statemachines 14-18 are protected by firewall 26 and can be described asbeing behind firewall 26. Remote computer 22 is outside the protectionof firewall 26 and can be described as being outside firewall 26. Moreparticularly, firewall 26 prevents a remote computer 22 fromestablishing a connection with state machines 14-18. However, statemachines 14-18, from behind firewall 26, can establish a connection withremote computer 22. Once the connection is established by a particularstate machine 14, 16, or 18, remote computer 22 can send data to andrequest data from that state machine.

Firewall 26 can be implemented in both hardware and software, or acombination of both. More specifically, firewall 26 is used to preventunauthorized Internet users from accessing state machines 14-18. Allmessages entering or exiting LAN 12 pass through firewall 26. Firewall26 examines each message and blocks those messages that do not meetspecified security criteria. Firewall 26 may implement one or more ofthe following techniques:

Packet filtering: Firewall 26 looks at each packet entering or leavingLAN 12 and accepts or rejects a given packet based on user-definedrules.

Application gateway: Firewall 26 applies security mechanisms to specificapplications, such as FTP (File Transfer Protocol) and telnet servers.

Circuit-level gateway: Firewall 26 applies security mechanisms when aTCP (Transmission Control Protocol) or UDP (User Datagram Protocol)connection is established. Once the connection has been made, packetscan flow without further checking.

Proxy server: Firewall 26 intercepts all messages entering and leavingLAN 12 effectively hiding the true network addresses of devices 14-18.

Various embodiment of the present invention will allow a user operatingremote computer 22 or programming running on remote computer 22 totraverse firewall 26 and initiate network connections with statemachines 14-18. Once the connections are established, the state of eachstate machine 14-18 can be monitored and adjusted from outside LAN 12.For example, where a state machine is a printer with an embedded webserver, a connection with that printer can be established and its statuscan be monitored by an administrator remotely located outside LAN 12.Where the state machine is a computer running a device managementapplication such as Web JetAdmin, a connection with that computer can beestablished and the status of the network devices being managed can bemonitored by an administrator remotely located outside LAN 12. Theadministrator may detect that a particular printer's toner level is lowor that the printer is malfunctioning and then schedule a technician toremedy the identified problem. The administrator may also be able tosend data over the connection to correct a problem or improve theperformance of the printer.

COMPONENTS: The logical components of one embodiment of the inventionwill now be described with reference to the block diagram of FIG. 2. InFIG. 2, remote computer 22 of FIG. 1 is labeled “administration device.”Printer 16 of FIG. 1 is labeled generically “state machine.” Remotecomputer 22 represents generally any computing device capable of networkcommunications that is separated from state machine 16 by firewall 26.

While state machine 16 is allowed to establish a connection with remotecomputer 22, firewall 26 prevents remote computer 22 from directlyestablishing a network connection with state machine 16. Becauseelectronic mail messages are typically assumed to be harmless, firewall26 allows electronic mail messages to pass freely from remote computer22 to state machine 16. Consequently, remote computer 22 can initiate anetwork connection and traverse firewall 26 by sending an electronicmail message to state machine 16, the mail message instructing statemachine 16 to establish a network connection with remote computer 22.Once the connection is established, communications can continue betweenstate machine 16 and remote computer 22 unfettered by firewall 26.

Remote computer 22 includes remote administrator 28 and state monitor32. Remote administrator 28 represents generally any programming capableof initiating a network connection with state machine 16 in order torequest, receive, adjust, and return state data. The term state datameans electronic data representing the current status of a statemachine, in this case state machine 16. While in the example of FIG. 2,state data is requested and received from state machine 16, remoteadministrator 22 is capable of requesting and receiving state data fromone or more other state machines not shown.

In one embodiment, state monitor 32 represents generally any programmingcapable of processing state data received from state machine 16 byremote administrator 28 and taking action according set criteria. Forexample, where state machine 16 is a laser printer, state data receivedby remote administrator includes a toner level. When the toner levelreaches a specified threshold, state monitor 32 may instruct that a newtoner cartridge be ordered and delivered. The received state data mayalso indicate the number of pages printed. When that page count reachesa specified threshold, state monitor 32 may generate a messageindicating that preventative maintenance is required.

In another embodiment, state monitor 32 represents generally anyprogramming capable of generating a user interface allowing a user tomonitor the state data. Where portions of the state data can beadjusted, state monitor 32 includes controls in the user interface thatallows a user to adjust those portions.

Remote administrator 28 includes state module 34 and mail module 36.State module 34 represents any programming capable of requesting,adjusting, and returning adjusted state data. Where, as in this example,state machine 16 is a printer, it can have a number of configurabledefault settings relating to items such as duplexing, print resolution,paper source, and finishing operations such as collating and stapling.The state data for state machine 16 may indicate that by default, lettersized paper will be used, text and images will print at mediumresolution on only one side of a sheet of paper, multiple copies will becollated, and printed pages will be output to a main paper bin. Once aconnection is established between remote administrator 22 and statedevice 16, state module 34 may request and receive state data from statemachine 16 and then adjust that state data to indicate that text andimages will, by default, print at high resolution. When returningadjusted state data, state module 34 could return all state data butneed only return the adjusted portions.

State data can be requested and sent and adjusted state data returned ina number of manners. Once a connection is established between remoteadministrator 28 and state machine 16, state data may be requested andsent and adjusted state data returned using SNMP (Simple NetworkManagement Protocol). SNMP works by sending messages, called protocoldata units (PDUs), to different parts of a network. An SNMP-compliantstate machine stores state data in a Management Information Base (MIB)and returns this data to the SNMP requester, in this case, remoteadministrator 28. Remote administrator 28 can send adjusted state databy sending an SNMP message instructing state machine 16 to adjust itsstate. The established connection can take many forms. For example, theconnection can be a TCP/IP (Transmission Control Protocol/InternetProtocol) connection. SNMP messages can be sent directly over the TCP/IPconnection. For increased security, the SSL (Secure Sockets Layer)and/or S-HTTP (Secure Hypertext Transfer Protocol) may be used as afirewall-tunneling transport for instructions and data. Alternatively, aconnection may be established by state machine 16 returning anelectronic mail message to remote computer 22. In this case, SNMPmessages can be included in or attached to electronic mail messagesexchanged between remote computer 22 and state machine 16.

Mail module 36 represents generally any programming capable ofgenerating and sending an electronic mail message to state machine 16. Agenerated message can serve a number of purposes. It can instruct statemachine 16 to establish a connection with remote administrator 28 anddirect when the connection is to be made. Where, for example, remoteadministrator 28 can be accessed through an IP (Internet Protocol)address, the mail message may merely contain that IP address. Themessage may also include credentials that indicate that the messageoriginated from a known source as well as instructions indicating whenthe connection is to be made. A generated message can also serve as avessel for returning adjusted state data. Where state data is receivedthrough electronic mail, mail module 36 is also responsible forforwarding the state data to state module 34.

State machine 16 includes functional components 38 and localadministrator 40. Functional components 38 represent generally anycombination of hardware and/or programming that implements the tasks forwhich state machine 16 was intended. Where, as in the current example,state machine 16 is a printer, functional components 38 are the hardwareand programming responsible for printing pages of text and graphics.Local administrator 40 represents generally any programming capable ofestablishing a network connection with remote administrator 28 as wellas monitoring and adjusting the state of functional components 38. Forexample, the state of functional components 38 may be reflected in aMIB. Local administrator 40 is then responsible for administering thedevice using the appropriate MIB. Continuing with the printer example,local administrator 40 is responsible for monitoring items such as tonerlevels and adjusting configurable settings relating to items such as theprinter's default resolution and duplexing capabilities.

Local administrator 40 includes mail service 44 and state service 46.Mail service 44 represents any programming capable of receiving andprocessing electronic mail messages. Mail service 44 may also beresponsible for validating credentials supplied with an electronic mailmessage before establishing a network connection. State service 46represents any programming capable of establishing a network connectionwith remote administrator 28 as instructed in an electronic mailmessage, sending state data for functional components 38 over theconnection, and adjusting the state of functional components 38. Wherethe state of functional components 38 is reflected in an MIB, stateservice 46 is responsible for retrieving state data using the MIB andsending the state data over an established connection. State service 46is then also responsible for adjusting state data using the MIB asinstructed by remote administrator 28.

Once a network connection is established between remote administrator 28and local administrator 40, state module 34 using that connection, canrequest state data from state service 46. In response state service 46assembles and sends state data reflecting the current state offunctional components 38 over the connection to state service 34. If thestate data is adjusted, state module 34 returns the adjusted portionback over the connection to state service 46 which in turn adjusts thestate of functional components 38 as instructed.

OPERATION: FIGS. 3 and 4 are flow diagrams that help to illustrate stepstaken to traverse a firewall in order to establish a network connectionfor monitoring and managing a state machine according to variousembodiments of the present invention.

Starting with FIG. 3, an access request mail message is generated andsent (steps 52 and 54). With reference to FIG. 2, an access request mailmessage is an electronic mail message containing instructions directinglocal administrator 40 of state machine 16 to establish a networkconnection with remote administrator 28 of remote computer 22. Theaccess request mail message may simply include data identifying remoteadministrator 28 such as the network address for accessing remoteadministrator 28 or the electronic mail address for communicating withremote administrator 28. The access request mail message may alsoinclude other data. It may include credentials such as a digitalsignature for authenticating the source of the mail message. The mailmessage may include timing instructions. Timing instruction define whenlocal administrator 40 is to establish a connection. To help loadbalance network communications, timing instruction may dictate thatlocal administrator 40 is to establish a connection at two in themorning.

The access request mail message is received (step 56) and, if themessage includes credentials, authenticated (step 58). A connection isthen established with the remote administrator 28 identified in theaccess request mail message (step 60). For example, the connection maybe established by opening a TCP/IP connection using an IP addresscontained in the mail message. Where the access request mail messagedoes not contain credentials, the remote administrator 28 may beauthenticated after the connection is established and before any otherdata is shared. The connection can instead be established by sending anelectronic mail message to an address contained in the access requestmail message. If the access request mail message includes timinginstructions, the connection is established according to those timinginstructions.

A request for state data is sent over the connection (step 62). This mayinvolve sending an SNMP message over a TCP/IP connection to the statemachine 16, or it may involve sending an electronic mail messagecontaining the SNMP message to the state machine 16. Requested statedata is then returned over the connection (step 64). This may involvereturning an SNMP message over a TCP/IP connection to the remoteadministrator 28, or it may involve returning an electronic mail messagecontaining the SNMP message to the remote administrator 28. The SNMPmessage used to request state data in step 62 may be included in theaccess request mail message generated in step 52. Similarly, state datarequested in step 62 may be returned in the electronic mail message usedto establish a connection in step 60.

The returned state data is monitored and/or adjusted (step 66). Step 66can also be partially or completely automated. For example, statemonitor 32, without user input, may monitor the state data and takeaction according to set criteria. State monitor 42 may generate a userinterface that displays the state data. The user interface then includescontrols for adjusting the portions of state data than can beconfigured.

Where the state data is adjusted, those adjustments are sent over theconnection to local administrator 40 (step 68). Step 68 may involvesending an SNMP message in an electronic mail message or over a TCP/IPconnection. Local administrator 40 then applies the adjustments (step70).

FIG. 4 illustrates another approach to traversing a firewall. A pollingmail message is generated and sent (steps 72 and 74). With reference toFIG. 2, a polling mail message is an electronic mail message containinginstructions directing local administrator 40 of state machine 16 toperiodically establish a network connection with remote administrator 28of remote computer 22 to poll for a pending access request. In thisexample an access request is a request that local administrator 40 sendstate data to remote administrator. In contrast with the stepsillustrated in FIG. 3, the access request is not sent to localadministrator 40. Instead, local administrator 40, according to theinstructions in the polling mail message, connects to remoteadministrator 28 to determine if an access request has been made.

A polling mail message includes polling instructions and dataidentifying remote administrator 28. Polling instructions areinstructions directing the timing of when local administrator 40establishes connection with remote administrator 28. For example,polling instruction may direct local administrator 40 to connect withremote administrator 28 every X hours between date Y and date Z. Dataidentifying remote administrator 28 may be a network address foraccessing remote administrator 28 or the electronic mail address forcommunicating with remote administrator 28. The polling mail message mayalso include credentials such as a digital signature for authenticatingthe source of the polling mail message.

The polling mail message is received (step 76) and, if the messageincludes credentials, authenticated (step 78). A network connection isestablished with remote administrator 28 allowing remote administrator28 to be polled for pending access requests (step 80). Following thedetection of a pending access request, local administrator 40 sendsstate data to remote administrator 28 (step 82). Step 80 can beaccomplished by opening a TCP/IP connection with remote administrator28. If an access request is pending, remote administrator 28 sends arequest for state data and local administrator 40 returns the requestedstate data over the opened connection to complete step 82.

The returned state data is monitored and/or adjusted (step 84). Step 84can also be partially or completely automated. For example, statemonitor 32, without user input, may monitor the state data and takeaction according to set criteria. State monitor 32 may generate a userinterface that displays the state data. The user interface then includescontrols for adjusting the portions of state data than can beconfigured. Where the state data is adjusted, those adjustments are sentover the connection to local administrator 40 (step 86). Localadministrator 40 then applies the adjustments (step 88).

CONCLUSION: Although the flow charts of FIGS. 3 and 4 each show aspecific order of execution, the order of execution may differ from thatwhich is depicted. For example, the order of execution of two or moreblocks may be scrambled relative to the order shown. Also, two or moreblocks shown in succession may be executed concurrently or with partialconcurrence. All such variations are within the scope of the presentinvention.

The present invention can be embodied in any computer-readable media foruse by or in connection with an instruction execution system such as acomputer/processor based system or other system that can fetch or obtainthe logic from the computer-readable media and execute the instructionscontained therein. A “computer-readable media” can be any medium thatcan contain, store, or maintain programming for use by or in connectionwith the instruction execution system. The computer readable media cancomprise any one of many physical media such as, for example,electronic, magnetic, optical, electromagnetic, infrared, orsemiconductor media. More specific examples of a suitablecomputer-readable medium would include, but are not limited to, aportable magnetic computer diskette such as a floppy diskette or harddrive, a random access memory (RAM), a read-only memory (ROM), anerasable programmable read-only memory, a portable compact disc, or anycombination thereof.

The present invention has been shown and described with reference to theforegoing exemplary embodiments. It is to be understood, however, thatother forms, details, and embodiments may be made without departing fromthe spirit and scope of the invention which is defined in the followingclaims.

What is claimed is:
 1. A method of traversing a firewall that preventsremote devices for accessing, but allows remote devices to sendelectronic mail messages to, a plurality of local network devices, themethod performed by a hardware processor of a remote administratordevice and comprising: sending an electronic mail message to arespective one of the plurality of local network devices behind thefirewall, the electronic mail message comprising instructions for therespective local network device to establish a connection with theremote administrator device located outside the firewall; and monitoringstate data for the respective local network device, the state data beingreceived over the connection.
 2. The method of claim 1, furthercomprising: once the connection is established, sending a request forthe state data over the connection.
 3. The method of claim 1, furthercomprising: once the connection is established, determining whether anaccess request is pending; and in response to determining that an accessrequest is pending, sending a request for the state data over theconnection.
 4. The method of claim 1, further comprising: adjusting thestate data; and sending the adjusted state data to the respective localnetwork device over the connection with an instruction to apply theadjusted state data to settings of the respective local network device.5. The method of claim 4, wherein the respective local network devicecomprises a network printer.
 6. The method of claim 5, wherein settingscomprise configurable default settings of the network printer, andwherein the instruction to apply the adjusted state data causes thenetwork printer to adjust the configurable default settings.
 7. Themethod of claim 6, wherein the configurable default settings comprise atleast one of duplexing settings, print resolution settings, paper sourcesettings, and finishing settings.
 8. The method of claim 1, wherein theelectronic mail message further comprises credentials of the remoteadministrator device to enable the respective local network device toauthenticate the remote administrator device.
 9. A remote administratordevice comprising: a hardware processor; and a memory storinginstructions that, when executed by the hardware processor locatedoutside a firewall, cause the remote administrator device to: send anelectronic mail message to a respective one of a plurality of localnetwork devices behind the firewall, the electronic mail messagecomprising instructions for the respective local network device toestablish a connection with the remote administrator device, wherein thefirewall prevents remote devices from accessing, but allows remotedevices to send electronic mail messages to the plurality of localnetwork devices; and monitor state data for the respective local networkdevice, the state data being received over the connection.
 10. Theremote administrator device of claim 9, wherein the executedinstructions further cause the remote administrator device to: once theconnection is established, send a request for the state data over theconnection.
 11. The remote administrator device of claim 9, wherein theexecuted instructions further cause the remote administrator device to:once the connection is established, determine whether an access requestis pending; and in response to determining that an access request ispending, send a request for the state data over the connection.
 12. Theremote administrator device of claim 9, wherein the executedinstructions further cause the remote administrator device to: adjustthe state data; and send the adjusted state data to the respective localnetwork device over the connection with an instruction to apply theadjusted state data to settings of the respective local network device.13. The remote administrator device of claim 12, wherein the respectivelocal network device comprises a network printer, and wherein thesettings comprise configurable default settings of the network printer,and wherein the instruction to apply the adjusted state data causes thenetwork printer to adjust the configurable default settings.
 14. Theremote administrator device of claim 13, wherein the configurabledefault settings comprise at least one of duplexing settings, printresolution settings, paper source settings, and finishing settings. 15.A non-transitory computer readable medium storing instructions that,when executed by a hardware processor of a remote administrator devicelocated outside a firewall, cause the remote administrator device to:send an electronic mail message to a respective one of a plurality oflocal network devices behind the firewall, the electronic mail messagecomprising instructions for the respective local network device toestablish a connection with the remote administrator device, wherein thefirewall prevents remote devices from accessing, but allows remotedevices to send electronic mail messages to the plurality of localnetwork devices; and monitor state data for the respective local networkdevice, the state data being received over the connection.